This PatchSiren debrief provides defensive context on CVE-2026-110475, a critical authentication and authorization vulnerability in the CreditNirvana Collections Platform. The vulnerability allows unauthenticated remote attackers to manipulate authentication requests, access APIs without a valid session, enumerate platform users, establish sessions as arbitrary users, and access/modify sensitive informati [truncated]
CVE-2026-110474 debrief based on the supplied source corpus. The CreditNirvana Agentic AI Call Centre application contains a hardcoded static API Key in its client-side JavaScript bundle, allowing unauthenticated remote attackers to potentially retrieve sensitive call transcripts and recordings by downloading client-side JavaScript files and extracting the API key. Defenders should prioritize verifying ex [truncated]
